CVE-2004-2730

Vulnerability

Sysinternals PsTools before version 2.05, including PsExec before 1.54, PsGetsid before 1.41, PsInfo before 1.61, PsKill before 1.03, PsList before 1.26, PsLoglist before 2.51, PsPasswd before 1.21, PsService before 2.12, PsSuspend before 1.05, and PsShutdown before 2.32, does not properly disconnect from remote IPC$ and ADMIN$ shares after use [1]. This leaves the share mappings active.

Exploitation

An attacker with local access to a system where these tools have been used can leverage the lingering share mappings. No additional authentication or network position is required, as the share connections were established during prior legitimate use [1]. The attacker can access the previously connected remote shares (IPC$ and ADMIN$) with the same privileges as the original user.

Impact

Successful exploitation allows a local user to access remote IPC$ and ADMIN$ shares with elevated privileges that were originally used by the tool [1]. This could lead to unauthorized information disclosure or further compromise of the remote system if the original session had administrative rights.

Mitigation

Upgrade to PsTools version 2.05 or later, which includes updated versions of all affected tools that properly disconnect from remote shares after use [1]. No workaround is documented in the available references.